Detecting anomalous behavior, behavior that a person or organization of a certain type is not supposed to exhibit, can be a first step towards stopping potentially criminal activities. While such behavior may be easy to recognize by closely watching an individual whose normal pattern of behavior is known, such monitoring becomes impractical, either by humans or using computer-implemented technology, when a group of people or organizations is involved, especially as the number of people whose behavior needs to be monitored grows and their normal behavior is not apriori known. For example, health care providers have a variety of specializations, and their normal behavior in prescribing treatments and medicines, including the kind and number of each particular medicine, differs depending on their specialization. Thus, a cardiologists generally prescribes a high proportion of cardiac medications while an oncologist generally prescribes a high percentage of chemotherapy drugs. While, despite the differences in specialties, these health care providers may share an anomalous behavior, such as prescribing a high amount of painkillers or other narcotics, without initially knowing their normal prescription pattern, detecting their anomalous prescriptions becomes a challenge.
Current technologies do not allow to efficiently recognize the anomalous behaviors in a community with multiple members. For example, U.S. Pat. No. 8,336,855, to Aggarwal et al., issued Dec. 25, 2012, discloses a way to identify communities in an information network, such as a social network, by identifying one or more nodes and edges in the network, identifying a sequence of one or more nodes using a random walk on the one or more nodes, and mining the sequence to determine patterns in the network. While allowing the identification of communities in the network, the Aggarwal work does not address how to recognize anomalous behaviors in these communities.
Similarly, U.S. Pat. No. 7,739,313, to Mishra et al., issued Jun. 15, 2010, describes a method and system for finding a conjunctive group. Two groups of points are identified and a first sample of a predetermined size is drawn from the first group. Subsets are identified within the first sample and a subgroup of the second group of points that share an intersection with all of the points in the first sample is identified. Subsequently, a subgroup of the first group of points that share an intersection with a specified number of the points in the subgroup of the second group of points are identified. Finally, a third group of points that represents a conjunctive cluster is output, with the product of the magnitude of the subgroup of the second group and the magnitude of the subgroup of the first group being maximized. While describing how to find conjunctive clusters, Mishra fails to address how to recognize anomalous behaviors in these communities.
Likewise, U.S. Pat. No. 7,884,434, to Hildrum et al., issued Nov. 30, 2010, describes a way to perform focused community discovery in a network. In particular, Hildrum describes a way to discover a community in a given entity in an interaction graph, with nodes representing entities in the graph and representing interactions between the connected nodes. The nodes are partitioned into different sets based on the interaction information to minimize the numbers of interaction pairs that need to be considered. Entities are moved between the different sets such that the community is discovered once a measure associated with an objective function is minimized. While describing how to discover communities, Hildrum fails to address how to recognize anomalous behaviors in these communities.
Therefore, there is a need for a computer-implemented system and method for discovering heterogeneous communities with anomalous components.